topic Re: Identify unused ACLs and object groups in Network Security

Identify unused ACLs and object groups

MATTHEW BECK — Mon, 11 Mar 2019 13:56:53 GMT

Hello all,

Can anyone point me to a software product (preferably Cisco) that will analyze a PIX 6.3 firewall rule set and determine which ACLs are not in use and which object groups are not referenced by any ACLs? I know I can show access-list to see hit counts, but this firewall has thousands of rules.

Thanks,

Matt

Re: Identify unused ACLs and object groups

bwilmoth — Fri, 17 Oct 2008 15:04:47 GMT

As far as I know there are some recommended practices allow you to summarize and simplify your ACE entries:

1)Use contiguous host addresses whenever possible. Aggegrate host statements in ACEs/object-groups into networks.

2)Use 'any' instead of networks, and use networks instead of hosts when possible.

3)Try to simplify object-groups. This can potentially save hundreds of ACEs when the ACLs are expanded.

4)Group together individual port statements into a range.

Re: Identify unused ACLs and object groups

josh — Fri, 17 Oct 2008 19:55:53 GMT

sh access-list | inc hitcnt=0

enter

This will only give the non-matched lines.

dump the results into excel with the ( as a text delimiter. This will clip off the hitcnt=0) 0x15abbe7c from the end of the lines. The drop it into notepad and you can replace "access-list" with "no access-list"

Re: Identify unused ACLs and object groups

MATTHEW BECK — Fri, 17 Oct 2008 20:07:19 GMT

Hi,

Actually, that won't work with object groups like I have configured. When you do the show access-list command you get:

access-l YYY line 1 perm...

access-l YYY line 2 perm...

If I try to no out anything but the first line which includes the name of the object groups, I'm going to get an error. And I definitely don't want to delete the entire line because only 1 object in the group may be unused - the rest will be valid.

Thanks, and enjoy your weekend.

Matt

Re: Identify unused ACLs and object groups

Farrukh Haroon — Sun, 19 Oct 2008 05:41:44 GMT

For the access-lists you could do it manually like the following.

Firsto do a:

show access-l | inc elements

Then compare it with:

show run access-group

Regards

Farrukh

Re: Identify unused ACLs and object groups

cisco24x7 — Sun, 19 Oct 2008 09:33:43 GMT

I've done this before and it was VERY painful.

Here is what i did:

1- Use a freeware tool call odumper/ofiller,

written by a Checkpoint engineer to dump

the rules and object into a Checkpoint

SmartCenter

2- In the Checkpoint security, I can use the

"right-click" functions to findout which

objects have NOT been used. This can be

relatively quickly

3- Use Cisco conversion tool to convert

Checkpoint rule back into Pix rules.

Step 1 and 2 worked quite well but step

3 was a big mess especially when you have

a large security policy.

my 2c.